CVE-2026-90255

Status: UPDATED  |  Advisory ID: CVE-2026-90255

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: hci_conn: fix the SCO setup context lifetime

hci_setup_sync() queues a conn_handle_t with a NULL destroy callback, so

the context is only freed if hci_enhanced_setup_sync() actually runs. An

entry that is cancelled instead is leaked, as

_hci_cmd_sync_cancel_entry() does not release entry->data when there is

no destroy callback, and hci_cmd_sync_clear() cancels every pending entry

when the controller is unregistered.

The context also stores a bare hci_conn pointer, so the connection can be

freed while the work is queued. The dequeue in hci_conn_del() does not

cover it either, as it matches on entry->data == conn and entry->data is

the wrapper here. Same problem as commit 2f5d635ad590 ("Bluetooth:

hci_sync: hold conn in hci_connect_acl/le_sync() callbacks").

Hold the connection and release both from a destroy callback. The

submission failure path drops both, since hci_cmd_sync_submit() does not

call the destroy callback when it fails to queue. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References